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Abstract: Models of the dynamics of cellular interaction networks have be- 
come increasingly larger in recent years. Formal verification based on model 
checking provides a powerful technology to keep up with this increase in scale 
and complexity. The application of model-checking approaches is hampered, 
however, by the difficulty for non-expert users to formulate appropriate ques- 
tions in temporal logic. In order to deal with this problem, we propose the use 
of patterns, that is, high-level query templates that capture recurring biological 
questions and that can be automatically translated into temporal logic. The ap- 
plicability of the developed set of patterns has been investigated by the analysis 
of an extended model of the network of global regulators controlling the carbon 
starvation response in Escherichia coli. 

Key-words: Formal verification, Genetic regulatory networks, Systems biol- 
ogy, Qualitative Simulation, Temporal logic 
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Patterns en Logique Temporelle pour faire des 
requetes a modeles dynamiques de reseaux 
d'interaction cellulaires 

Resume : Les modeles de la dynamique des reseaux d'interaction cellu- 
laires sont devenus de plus en plus grands au cours des dcrnicrcs annces. La 
verification formclle bascc sur le model checking fournit une technologie puis- 
sante pour faire face a cette augmentation en taille et en complexite. Mal- 
heureusement l'application de telles approchcs est limitcc par la difficultc pour 
l'utilisateur non experiments de formuler des questions appropriees en logique 
temporelle. Pour faire face a ce problemc, nous proposons l'utilisation de pat- 
terns, des squelettes de requetes a haut niveau qui expriment des questions 
biologiques recurrentes et qui peuvent etre automatiquement traduites en lo- 
gique temporelle. L 'applicability de l'ensemble de patterns developpes a ete 
etudiee par l'analyse d'une extension du modele du reseau des regulateurs qui 
controle la reponse au manque de carbone chez Escherichia coli. 

Mots-cles : Verification formelle, Reseaux de regulation genique, Biologie des 
systemes, Simulation qualitative, Logique temporelle 
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1 Introduction 

Models of the dynamics of cellular interaction networks have become increas- 
ingly larger in recent years. While whole-cell models are not on the horizon yet, 
complex networks underlying specific cellular processes have been modeled in 
detail, such as the osmotic shock response in yeast [35], the yeast cell cycle [5], 
and signalling pathways involved in cancer [28) . The study of these models by 
means of analysis and simulation tools leads to large amounts of predictions, 
typically time-courses of the concentrations of several dozens of molecular com- 
ponents in a variety of physiological conditions and genetic backgrounds. This 
raises the question how to make sense of these data, that is, how to obtain an 
understanding of the way in which particular molecular mechanisms control the 
cellular process under study, and how to identify interesting predictions of novel 
phenomena that can be confronted with experimental data. 

Methods from the field of formal verification provide a promising way to deal 
with the analysis of large and complex models of cellular interaction networks 
[13] . Generally speaking, formal verification proceeds by specifying dynami- 
cal properties of interest as statements in temporal logic. Efficient so-called 
model-checking algorithms, implemented in publicly-available computer tools, 
exist to determine whether the statements are true or false, and thus whether 
the dynamic properties are satisfied by the model. The methods are gener- 
ally applicable to discrete models of cellular interaction networks, or continuous 
models that have been discretized under a suitable abstraction criterion. Sev- 
eral examples exist of the application of model-checking approaches in systems 
biology {e.g., 0H0CDIE1CE1]). 

Formal verification based on model checking provides a powerful technology 
to query models of cellular interaction networks. It raises a number of new 
issues though, notably that of formulating good questions when analyzing a 
huge network model. The problem of posing relevant and interesting questions 
is critical in modeling in general, but even more so in the context of applying 
formal verification techniques, due to the fact that it is not easy for non-experts 
to formulate queries in temporal logic. For instance, the property "Gene g is 
eventually expressed, and necessarily preceded over the whole duration of the 
experiment by a concentration larger than 0.9 /iM of the transcription factor P" 
corresponds to the following CTL formula, where exp g denotes expression of g: 

EF{exp g ) A ^E{True U (-.([P] > 0.9/xM) A E{True U exp g ))) (1) 

The response to this problem proposed by the formal verification community 
is the use of patterns, that is, high-level query templates that capture recur- 
ring questions in a specific application domain and that can be automatically 
translated to temporal logic ,12]. Apart from lists of example queries jS], the 
systematic definition of queries has not received any attention in systems biology 
thus far. 

The aim of this paper is to develop a set of patterns for the analysis of dy- 
namic models of cellular interaction networks. Its main contributions lie, first, 
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in the development of generic query templates, based on a review of frequently- 
asked questions by modelers, and the translation of these templates into tem- 
poral logic formulas (Sec. [2j- Second, we apply the patterns for analyzing the 
qualitative dynamics of a large and complex model of the E. coli carbon star- 
vation response (Sec. [3]). This model extends a previous model [27] by taking 
into account additional regulators of the bacterium, notably a module centered 
around the general stress response factor RpoS. We verify the control the latter 
is predicted to exert on the DNA supercoiling level in the cell. 

2 Patterns of biological queries 

2.1 Description of network dynamics 

As a basic hypothesis, we assume that the dynamics of molecular interaction 
networks can be modeled by means of finite state transition systems (FSTSs) 
[TT] . The latter formalism provides a general description of a dynamical system 
that implicitly or explicitly underlies many of the existing discrete formalisms 
used to model cellular interaction networks, such as Boolean networks and their 
generalizations, Petri nets, and process algebras. In addition, by defining appro- 
priate discrete abstractions, continuous models of cellular interaction networks 
can also be mapped to FSTSs. The generality of the FSTS formalism is impor- 
tant for assuring the wide applicability of the patterns developed in this section. 
Moreover, statements in temporal logics are usually interpreted on FSTSs, so 
that the latter naturally connect network models to model-checking tools. 

A finite state transition system is formally defined as a tuple £ = 
(S, AP, L,T, So), where S is a set of states, AP is a set of atomic proposi- 
tions, L : S — » 2 AP is a labeling function that associates to a state s E S the 
set of atomic propositions satisfied by s, T C S x S is a relation defining tran- 
sitions between states, and So Q S is a set of initial states. For our purpose, S 
describes the possible states of the cellular interaction network, each of which 
is characterized by a set of atomic propositions, such as that the concentration 
of protein P is increasing, or that the concentration of metabolite M is smaller 
than 5 mM. 

2.2 Identification of patterns 

The notion of patterns originates in architecture [1] and was introduced in the 
domain of software engineering as a means to capture expert solutions to recur- 
ring problems in program design [15J. In the formal verification domain they 
have been introduced in an influential paper by [12j . to help non-expert users 
formulate their temporal-logic queries. In the latter context, patterns are high- 
level descriptions of frequently asked questions in an application domain that 
are formulated in structured natural language rather than temporal logic. The 
aim of the patterns is not to cover all possible questions an expert can think of, 
but rather to simplify the formulation of those that are primary. 
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The difficulty of proposing patterns is to come up with a limited number 
of query schemas that are sufficiently generic to be applicable in a variety of 
situations, and at the same time sufficiently concrete to be comprehensible for 
the non-expert user. Moreover, the overlap between the patterns should be 
minimal. We analyzed a large number of modeling studies in systems biology 
(starting from the references in [29j). as well as previous applications of model 
checking and temporal logic (e.g., [H [H [JJ 111 HI] ) ■ This bibliographic research 
allowed us to identify an open-ended list of questions on the dynamics of genetic, 
metabolic, and signal transduction networks, for instance: 

• Is the basal glycerol production level combined with rapid closure of Fpsl 
sufficient to explain an initial glycerol accumulation after osmotic shock? 

m 

• Once a cell has executed START, does it slip back into Gl phase and 
repeat START? Or rather, must it execute a FINISH to return to Gl? 
0- 

• Does She phosphorylation exhibit a relative acceleration with decreasing 
EGF concentration and show a decline over time? [28] 

The identified questions were grouped into four categories, depending on 
whether they concerned the occurrence/ exclusion, consequence, sequence, and 
invariance of cellular events. For each of these, we developed an appropriate 
pattern, capturing the essence of the question and the most relevant variants. 

2.3 Description of patterns 

The patterns consist of structured natural language phrases, represented in 
schematic form, with placeholders for so-called state descriptors. A state de- 
scriptor is a statement expressing a state property, and takes the form of (a 
Boolean combination of) atomic propositions. Let <fi, ip be state descriptors, 
then 

(p,ip::=pi G AP\p2 eAP\... 
::= A tp\<f> =>ip\... 

The state descriptors are interpreted on the FSTS, in the sense that their 
meaning is formally defined as the set of states Si C S satisfying the state 
descriptor. In addition to (Boolean combinations of) atomic propositions, the 
state descriptors may be temporal-logic formulas defined on the atomic propo- 
sitions. We will return to this generalization in Sec. [5] 

It is often convenient to introduce predefined state descriptors that capture 
Boolean combinations of atomic propositions that are recurrently used. Some 
examples of predefined state descriptors that we found useful are the following: 
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• Increasesi/ Decreases^, the concentration of molecular component i in- 
creases/decreases in this state; 

• Is Steady State: the concentrations of all molecular components are steady 
in this state; 

• IsOscillatoryState: the concentrations of some molecular components 
oscillate in this state. 

Notice that the precise definition of the state descriptors depends on the 
particular type of FSTS that is used, as the latter determines the set of atomic 
propositions AP. 

Definition 1 (Occurrence/exclusion pattern) 



It 


is possible 


for a state 1 


4> 1 to occur 




is not possible 





This pattern represents the concepts of occurrence and its negation, exclu- 
sion. It will often be used during the development of a model to check for the 
presence or absence of some property that was experimentally observed. For 
instance, "It is possible for a state with high expression of protein Pi to occur". 
Using this pattern, we can also check for mutual exclusion, by using the pattern 
negative form in combination with a conjunctive state descriptor. For instance, 
"It is not possible for a state to occur in which protein Pi and protein P2 are 
highly expressed" . 

More generally, the exclusion pattern captures the safety properties used in 
the domain of concurrent systems. A safety property (of which mutual exclusion 
is a typical example) expresses that "something bad never happens" during the 
execution of the system, in our example a bad state violating mutual exclusion. 

Definition 2 (Consequence pattern) 



If a state | <t> | occurs, 



| then it is 


possibly 


followed by a state U> 




necessarily 





The consequence pattern relates two events separated in time. More pre- 
cisely, it expresses that if the first state occurs, then it is possibly or necessarily 
followed by the occurrence of the second state. If the latter state necessarily 
follows, then the consequence pattern expresses a form of causal relation. In- 
stances of this pattern are, for instance, "If a state occurs in which protein P is 
phosphorylated, then it is possibly followed by a state in which the expression of 
gene g decreases" , or "If a state occurs in which the concentration of protein P 
is below 5 /xM, then it is necessarily followed by a state in which the expression 
of gene g is at its basal level" . 
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Definition 3 (Sequence pattern) 



A state | tp | is reached and 



is 


possibly 


preceded 


at some time 


by a state <t> 




necessarily 




all the time 





The sequence pattern represents an ordering relation between two events. It 
ought not to be confused with the consequence pattern, since the conditional 
occurrence of the second state which characterizes the latter, is absent in the 
sequence pattern. Both the first and the second state, in that order, have to be 
observed for an instance of the sequence pattern to be true. 

Four variants of the pattern are distinguished, depending on whether the 
second state follows possibly or necessarily after the first state, and whether the 
system is in the first state all the time or only at some time before the occurrence 
of the second state. Instances of this pattern are "A state in which reactions 
Ri and R2 occur at a high rate is reached after 2 min, and is possibly preceded 
at some time by a state in which the transcription factor P is phosphorylated" 
or "A steady state is reached and is necessarily preceded all the time by a state 
in which nutrient N is absent" . 

Definition 4 (Invariance pattern) 



A state <P 


can 


persist indefinitely 




must 





The invariance pattern is used to check if the system can or must remain 
indefinitely in a state. In contrast with the occurrence/exclusion pattern, the 
question is not whether a particular state can be reached, but rather whether 
a particular state is invariable. Instances of the pattern are "A state in which 
reaction R occurs at a high rate can persist indefinitely" and "A state with a 
basal expression of gene g must persist indefinitely" . 

2.4 Translation to temporal logic 

By defining a translation into temporal logic of the patterns, the user queries 
can be automatically cast in a form that allows the verification of the specified 
property by means of model-checking tools. The patterns defined above are 
independent of a particular temporal logic, which allows the same high-level 
specification of a user query to be verified by means of different approaches and 
tools. It is worth noticing though that some of the patterns we propose have 
a branching-time nature (e.g., the consequence and the sequence patterns), and 
therefore these are not translatable into a linear-time formalism, such as LTL 

Two examples of translations of the patterns in Sec. 12.31 are shown in tabu- 
lar form: the Computational Tree Logic (CTL) translation and the /i-calculus 
translation (Table [1]). In both CTL and /i-calculus, formulas are built upon 
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atomic propositions. Also, the usual connectors of propositional logic, such as 
negation (-1), logical or (V), logical and (A) and implication (=>), can be used 
in both logics. In addition, CTL provides two types of operators: path quan- 
tifiers, E and A, and temporal operators, such as F and G. Path quantifiers 
are used to specify that a property p is satisfied by some (E p) or every (A p) 
path starting from a given state. Temporal operators are used to specify that, 
given a state and a path starting from that state, a property p holds for some 
(F p) or for every (G p) state of the path. Each path quantifier must be paired 
with a temporal operator. In the case of /z-calculus, two types of operators 
are provided: fixed points, the least and greatest (y) , and modal operators, 
possibility (0) and necessity (□). Least and greatest fixed points specify finite 
and infinite recursive applications of a formula, respectively. For instance, given 
a state and a path starting from that state, the fact that a property p holds 
for some state or for all states of the path is expressed using a least or a 
greatest (v) fixed point, respectively. Modal operators are used to specify that, 
given a state, a property p possibly (0 p) or necessarily (□ p) holds on some or 
all of its outgoing states. 
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Occurrence/Exclusion pattern 


CTL 


/i-calculus 


It is possible for a state <j> to occur 

It is not possible for a state cf> to occur 


EF (</>) 
-^EF (</>) 




Consequence pattern 


If a state <j> occurs, then it is possibly followed by a state ip 
If a state (j> occurs, then it is necessarily followed by a state ijj 


AG => EF (i/0) 
AG {tj> => AF (ij))) 


vX.((<t> => nY.(ii) v oy)) a ax) 

vX.({<j> => fiY.(ip V BY)) A OX) 


Sequence pattern 


A state if) is reached and is possibly preceded at some time by a state <f> 

A state ij) is reached and is possibly preceded all the time by a state <f> 

A state tj] is reached and is necessarily preceded at some time by a state <j> 

A state ij) is reached and is necessarily preceded all the time by a state <j> 


EF (<f> A EF (</>)) 

E (0 U if)) 

EF (ij>) A 

-iE (-,<j> U ij)) 

EF (ip) A ->E(T U 

(^AE(TU ij>))) 


nx.{(4> a nY.{^ v oy)) v ox) 
^x.OvOaOA)) 

fiX.(ij)\/0X) a 
^hY.(iP V A OY)) 
fj,X.(ipV0X) A^fj,Y.{^4> A 
(iZ.ty V (T A 02)) V (T A 0*0) 


Invariance pattern 


A state cj> can persist indefinitely 
A state cj> must persist indefinitely 


EG (</>) 
AG (0) 


vX.{<j,A0X) 

vX.(<t>r\UX) 



Table 1: Rules for the translation of the patterns into CTL and ^-calculus. For each of the four patterns, the translation of all 
variants is shown. We use the version of /Lt-calculus presented in [53], which is interpreted on classical Kripke structures. The 
symbol T stands for True. 
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3 Carbon Starvation Response in E. coli 

3.1 Model of carbon starvation response 

To test the applicability of the temporal logic patterns, we have used our ap- 
proach for the analysis of a model of the carbon starvation response in the 
bacterium E. coli. In the absence of essential carbon sources in its growth envi- 
ronment, an E. coli population abandons exponential growth and enters a non- 
growth state called stationary phase. This growth-phase transition is accompa- 
nied by numerous physiological changes in the bacteria [21j . and controlled on 
the molecular level by a complex genetic regulatory network integrating various 
environmental signals. 

The molecular basis of the adaptation of the growth of E. coli to the nu- 
tritional conditions has been the focus of extensive studies for decades [TH [20] . 
However, notwithstanding the enormous amount of information accumulated 
on the genes, proteins, and other molecules known to be involved in the stress 
adaptation process, it is currently not understood how the response of the cell 
emerges from the network of molecular interactions. Moreover, with some ex- 
ceptions |6J , numerical values for the kinetic parameters and the molecular con- 
centrations are absent, which makes it difficult to apply traditional methods for 
the dynamical modeling of genetic regulatory networks. 

These circumstances have motivated the development of a qualitative model 
of the carbon starvation response network using a class of piecewise-linear (PL) 
differential equations. The PL models, originally introduced by [18] , provide a 
coarse-grained picture of the dynamics of genetic regulatory networks. They as- 
sociate a protein concentration variable to each of the genes in the network, and 
capture the switch-like character of gene regulation by means of step functions 
that change their value at a threshold concentration of the proteins. The advan- 
tage of using PL models is that the qualitative dynamics of the high-dimensional 
systems are relatively simple to analyze, using inequality constraints on the pa- 
rameters rather than exact numerical values [U [3] . This makes the PL models 
a valuable tool for the analysis of the carbon starvation network. 

In previous work we developed a PL model that we extend here by the 
general stress response factor RpoS and related regulators ([57]; Ropers et ai, 
in preparation). The dynamics of this system are described by nine coupled PL 
differential equations, and fifty inequality constraints on the parameter values. 

3.2 Qualitative simulation of carbon starvation response 

The mathematical properties of the class of PL models used for modeling the 
stress response network have been well-studied [H] . We have previously shown 
how discrete abstractions can be used to convert the continuous dynamics of 
the PL systems into a FSTS gj. The states S of the FSTS correspond to hy- 
perrectangular regions in the concentration space, while the transitions T arise 
from trajectories that enter one region from another. The atomic propositions 
AP describe, among other things, the concentration bounds of the regions and 
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the trend of the variables inside a region (increasing, decreasing, or steady). 
The generation of the FSTS from the PL model has been implemented in the 
computer tool Genetic Network Analyzer (GNA) [4]. GNA is able to export the 
FSTS to standard model checkers like NuSMV [TU] and CADP [IS]. 

The application of this approach to the model of the E. coli carbon starvation 
network generates a huge FSTS. The entire state set consists of approximately 
O(10 10 ) states, while the subset of states that is most relevant for our purpose, 
i.e. the states that are reachable from an initial state corresponding to a par- 
ticular growth state of the bacteria, still consists of O(10 3 ) states. It is clear 
that FSTSs of this size cannot be analyzed by visual inspection, and that formal 
verification techniques are needed. 

In the next section we show how the patterns defined in Sec. 12.31 can speed 
up the querying of these FSTSs, by simplifying the formulation of relevant 
properties to be tested. We are particularly interested in the question how 
the extension of the model with RpoS affects the predicted dynamics of the 
system. The instances of the patterns were translated into the temporal logic 
CTL following the translation rules of Table [TJ and then verified using the 
model-checker NuSMV. 

4 Analysis of Carbon Starvation Response 
Model using query patterns 

4.1 Mutual inhibition of Fis and CRP 

The proteins Fis and CRP mutually inhibit their expression (Fig. [I]). The reg- 
ulatory protein CRP is the target of a signal-transduction pathway, which acti- 
vates the adenylate cyclase Cya in case of carbon starvation. In turn, the latter 
synthesizes a small molecule, cAMP, which binds to CRP. This active form of 
CRP is able to regulate the expression of a large number of genes. In particu- 
lar, CRP-cAMP binds to the promoter region of the gene fis, thereby preventing 
synthesis of new Fis proteins. Fis is an important regulator of genes involved in 
the cellular metabolism but it also inhibits crp expression, by binding to mul- 
tiple sites in the two promoter regions of the gene, PI and P2. The regulatory 
interactions between genes fis and crp form a positive feedback loop, a motif 
often found in the genetic regulatory networks. When present in isolation, this 
kind of motif has been shown to lead to bistability [17] . 

The question can be asked whether the motif is also functional in the context 
of the carbon starvation response network. For instance, the expression of fis is 
not only controlled by CRP-cAMP, but also by the DNA supercoiling level and 
Fis itself. To check whether the bistability property is preserved in the larger 
network, we used two instances of the occurrence/exclusion pattern to express 
that it is impossible that proteins Fis and CRP be simultaneously present at 
high and at low concentration in the cells (Table[2]). This property was shown to 
be true by the NuSMV model checker. We conclude that the positive feedback 
loop involving fis and crp is functional. 
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Figure 1 : (a) Network of key genes, proteins and regulatory interactions involved in the carbon starvation response network 
in E. coli. (b) PL differential equation and parameter inequality constraints for the gyrase GyrAB. The variable x gyr AB 
denotes the concentration of GyrAB. The protein is produced at a rate K gyr AB if the DNA supercoiling level is not high, 
that is, if the concentration of GyrAB itself is below the threshold gyrAB , and the concentrations of the topoisomerase 
TopA and the gyrase inhibitor GyrI are above the thresholds 0\ opA and 9 gyrI , respectively. The regulatory logic of gyrAB 
expression is modeled by means of step functions. For instance, s + (x gyr AB,0g yrAB ) evaluates to 1, if x gyr AB > 2 gyr AB ( an< ^ 
to otherwise). The protein is degraded at a rate proportional to its own concentration, "f gyr AB x gyr AB- The constraint 
® gyrAB < K gyrAB /■") 'gyrAB < fnax gyr AB express that the derepression of the gyrAB promoter allows the concentration of 
GyrAB to reach a high level, above the threshold 2 gyrAB . 
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4.2 Damped oscillations after carbon upshift 

The carbon starvation response network also contains a negative feedback loop, 
involving the genes gyrAB, top A, and fis (Fig. [1]). GyrAB is a gyrase protein 
which supercoils the DNA structure, whereas the topoisomerase TopA relaxes 
it. An increase of the DNA supercoiling level stimulates expression of Fis, 
which in turn decreases the supercoiling level, by stimulating topA expression 
and inhibiting gyrAB expression. The resulting negative feedback loop was 
predicted to give rise to (damped) oscillations of Fis and GyrAB concentrations 
after a carbon upshift [27] , 

In the present version of our model, additional interactions contribute to 
controlling the DNA supercoiling level. Hence, the gyrase inhibitor GyrI re- 
presses the activity of GyrAB by forming a complex with the protein. The 
expression of gyrl is notably stimulated by RpoS [25 . We formulated a con- 
sequence pattern to verify whether this affects the functioning of the negative 
feedback loop. In particular, we checked whether the carbon upshift is still a 
necessary condition for the occurrence of damped oscillations, as it was in the 
previous model (Table \2§ ■ In the pattern we made use of the state descriptor 
isOscillatoryState, which labels states as belonging to a (terminal) cycle in the 
FSTS. The occurrence of an oscillatory state could alternatively be expressed 
using temporal logic formulas (Sec. [5]). The model-checker returned true for 
the query, meaning that the damped oscillations still occur following a carbon 
upshift. 

4.3 Control of entry into stationary phase by RpoS 

RpoS is a stress sigma factor that allows cells to adapt to and survive under 
harmful conditions by entering stationary phase [5D]. Due to its key role, the 
concentration of RpoS is tightly regulated, at the transcriptional, translational, 
and post-translational levels. The stability of the protein is mainly controlled in 
our conditions: while cells grow on a carbon source, RpoS is actively degraded 
through the protein RssB, which binds to RpoS and targets the factor to an 
intracellular protease. However, the depletion of the carbon source inactivates 
RssB, thus allowing RpoS to accumulate at a high concentration. 

Given the importance of RpoS for cell survival, one may ask whether the 
entry into stationary phase is always preceded by the accumulation of RpoS 
in the cell. We formulated this question using a sequence pattern, where the 
stationary phase is represented by a low level of stable RNAs rrn (Table [2]) . 
The latter indicator is motivated by the fact that stationary-phase cells do not 
need high levels of these RNAs, which are necessary for the high translational 
activity of the exponential phase. The property is true, which indicates that 
the entry into stationary phase cannot occur before RpoS has accumulated. 
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4.4 Expression of topA during growth-phase transitions 

Our previous model was incapable of accounting for the control of DNA super- 
coiling during growth-phase transitions. In particular, TopA was predicted to 
be never expressed, which is consistent with published data |26j . The extension 
of the model with RpoS makes it possible to refine the description of the control 
of the DNA supercoiling level. On the one hand, GyrAB activity is regulated 
by GyrI, as mentioned previously, and on the other hand, the topA promoter is 
activated by RpoS. 

In order to know whether topA is expressed in response to the carbon source 
availability, we used an invariance pattern to check if the absence of top A expres- 
sion persists indefinitely (Table [2]). The corresponding temporal logic formula 
is false and the diagnostic of the model-checker shows that expression of top A 
is stimulated at the entry into stationary phase, most likely under the influence 
of RpoS. Indeed, following carbon starvation, the protein RssB is inactivated, 
which leads to the accumulation of RpoS at high levels. RpoS in turn stimulates 
the expression of top A. 
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Occurrence/exclusion pattern: Mutual inhibition of Fis and CRP 

| It | is not possible | for a state | x crp > crp ^ crp — — A x f i S > 9j is | to occur 
| It | is not possible | for a state | x crp < Ai/ ls < 9j is | to occur | 

k^ 4-k z 4-k 3 * ~k^ i 

CTL: ^EF{x crp > ^±-sie±^jl Al/ls > Qj ) A^EF(x crp < Ax fls < 9j is ) 

I crp J j crp J 

k 1 4-k 2 -\-k 3 a k 1 i 

^-calculus: ^X.((x crp > ^ieI^e^ie. Ax fls > 6% s ) V <>X) A^X.({x crp <^Ax fls < 0) ia ) V OX) 

Jcrp J fcrp J 

Consequence pattern: Damped oscillations after nutrient upshift 

| If a state | x S i gna i < Osignai | occurs, then it is | necessarily | followed by a state | isOscillatory State \ 

CTL: AG ({x signa i < 8 signal ) => AF (isOscillatory State)) 

/i-calculus: vX.{{{x S i gna i < Osignai) =>■ nY. (isOscillatory State V OY)) A OX) 

Sequence pattern: Control of entry into stationary phase by RpoS 

| A state | x rpo s > 9\ po g | is reached and is | necessarily | preceded | at some time | by a state | x rrn > 9 rrn \ 
CTL: EF (x rpoS > 9~f^g) A ->E (^(x rrn > 9 rrn ) U (x rpoS > 9 l rpoS )) 

/x-calculus: ixX.((x rpo s > 9l poS ) V OX) A ^fiY.((x rpoS > 9l poS ) V (^(x rrn > 9 rrn ) A QY)) 

Invariance pattern: Expression of topA during growth-phase transitions 
| A state | Xt op A < 9\ opA | can | persist indefinitely | 
CTL: EG (x topA < 9] opA ) 

^-calculus: vX.((xt op A < 9] opA ) A QX) 

Table 2: Translation of the instances of the patterns used in the analysis of the E. coli carbon starvation response into 
and /i-calculus, following the translation rules in Table [T] 
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5 Discussion 

Formal verification techniques are promising tools for upscaling the analysis 
of cellular interaction networks. The widespread adoption of model-checking 
approaches is restrained, however, by the difficulty for non-expert users to for- 
mulate appropriate questions in temporal logics. Inspired by work in the formal 
verification community ([12], see also [24]), the first contribution of the paper 
consists in the formulation of a set of patterns in the form of query templates in 
structured natural language. The patterns capture a large number of frequently- 
asked questions by modelers in systems biology, but they are not restricted to 
a particular type of network or a particular biological system. In addition, we 
have provided translations of the patterns to two different temporal logics, CTL 
and /u-calculus. 

The second contribution of the paper is the use of these patterns for the anal- 
ysis of the complex genetic regulatory network involved in the carbon starvation 
response in E. coli. We have modeled this network by means of PL differential 
equations and simulated the qualitative dynamics of the system in response to 
carbon starvation and carbon upshift. Our model extends a previous model 
[27] with additional global regulators, notably the sigma factor RpoS, to better 
account for the control of DNA supercoiling during the growth transitions of 
the bacteria. The patterns are instantiated to verify the effect of this addition 
to the predicted network dynamics. 

The patterns proposed in this paper are globally consistent with those dis- 
cussed in [T2], but there are differences due to the specific application domain 
for which our patterns were developed. For instance, the notion of scope used 
by [12] is not commonly defined for all the patterns, but implicitly present 
through the use of specific variants for each pattern. Also, we have not explic- 
itly included patterns that can be obtained by the recursive application of other 
patterns, such as the chain response pattern defined in [12] . While patterns 
have not been used for the querying of cellular interaction networks thus far, 
some papers list example questions. It is reassuring to observe that all questions 
in the list of [S] can be expressed by means of the patterns in Sec. 12.31 

An obvious generalization of the patterns proposed in this paper, already 
briefly mentioned in Sec. [2] would be to allow state descriptors that are formu- 
las in temporal logic. For instance, instead of using atomic propositions to label 
states belonging to a (terminal) cycle in the FSTS, which requires the prelimi- 
nary detection of strongly connected components in the state transition graph, 
we could use temporal logic formulas [3] . The introduction of temporal logic for- 
mulas as state descriptors makes the patterns more general, but also potentially 
more complicated to formulate and dependent on a particular temporal logic. 
A compromise trading some expressive power for user-friendliness would be to 
restrict the possible temporal logic formulas to simple forms and introduce these 
as predefined state descriptors (Sec. 12. 3j ). This is consistent with the main idea 
underlying the use of patterns, namely that they cannot be expected to cover 
all possible queries, but rather should allow users to formulate their frequent 
questions without worrying about the translation to temporal logic. 
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